EUVD-2026-45360
GHSA-g2gr-xhcw-h7mc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 18, 2026
Authentication bypass in VMware Avi Load Balancer (versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2) lets a network-adjacent attacker circumvent the login mechanism and reach the Avi Controller control plane. Reported by VMware/Broadcom, it carries a CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) reflecting full unauthenticated compromise of confidentiality, integrity and availability. No public exploit is identified at time of analysis and it is not on the CISA KEV list, but the flaw class (CWE-287) and network-reachable admin plane make it a high-priority patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Avi Load Balancer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (vmware) · only source for this CVE.
CVSS VectorVendor: vmware
DescriptionCVE.org
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism.
Affected versions: 31.1.1 through 31.2.2 (fixed in 31.2.2-2p3) 30.1.1 through 30.2.6 (fixed in 30.2.7) 22.1.1 through 22.1.7 (fixed in 30.2.7)
Articles & Coverage 2
Executive ViewAI
VMware Avi Load Balancer versions 22.1.1-22.1.7, 30.1.1-30.2.6, and 31.1.1-31.2.2 contain a critical authentication bypass (CVSS 9.8) that allows unauthenticated network-adjacent attackers to gain full administrative control of the Avi Controller. This exposes an organization's entire load-balancing infrastructure-including traffic routing, SSL/TLS termination, and application delivery-to unauthorized compromise, eavesdropping, and denial of service. With no vendor patch currently available, affected infrastructure requires immediate protective action to prevent compromise of upstream applications and data.
Within 24 hours: inventory all deployed VMware Avi Load Balancers and identify instances running versions 22.1.1-22.1.7, 30.1.1-30.2.6, or 31.1.1-31.2.2; segment these by criticality and external network exposure. Within 7 days: implement Layer 3 firewall rules restricting access to Avi Controller management ports (22, 443) to only authorized administrator networks and jump hosts; enable detailed audit logging on all controller API calls and authentication attempts; scan historical logs for signs of unauthorized access or exploitation. Within 30 days: monitor VMware/Broadcom security bulletins for a released patch; develop a staged upgrade plan with roll-out windows; if patch timeline extends beyond organizational risk tolerance, evaluate failover to alternative load-balancing platforms or temporary removal of external-facing Avi instances from production.
Enforce network-layer access controls: restrict Layer 3/4 connectivity to Avi Controller management interfaces to only approved administrator IP ranges and bastion hosts using firewall ACLs. Deploy network-based IPS rules targeting authentication bypass patterns and anomalous controller API calls. Configure centralized SIEM alerting for all login attempts, privilege escalation events, and configuration changes on the controller. Temporarily disable remote/SSH management of the controller and require local console access only, if operationally feasible. Conduct immediate log analysis to detect any unauthorized admin-plane access or lateral movement from affected load balancers to internal systems.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Avi Load Balancer
View allDirectory traversal in VMware Avi Load Balancer (formerly Avi Networks NSX Advanced Load Balancer) lets authenticated ne
Remote code execution in VMware Avi Load Balancer exposes organizations running versions from 22.1.1 through 32.1.1 to a
Remote code execution in VMware Avi Load Balancer exposes the Avi Control Plane to arbitrary code execution by any low-p
Privilege escalation in VMware Avi Load Balancer exposes authenticated, network-accessible users to remote code executio
Authorization bypass in VMware Avi Load Balancer (branches 22.1.x, 30.x, 31.x, and 32.1.1) allows a network-based actor
Local privilege escalation in VMware (Broadcom) Avi Load Balancer allows a user who already has local access to the appl
Exploit-DB